MLflow CVE-2026-2393

Attacker must possess valid MLflow credentials with permissions to create webhooks via the MLflow API or UI (PR:L - low privileges required). The target MLflow installation must be running a vulnerable version (prior to 3.9.0) with webhook functionality enabled and accessible. Exploitation requires network connectivity from the MLflow server to the target SSRF destination - cloud metadata endpoints (169.254.169.254) for credential theft, internal services for reconnaissance, or external attacker-controlled servers for data exfiltration. No user interaction required (UI:N). The vulnerability is exploitable against default MLflow configurations that do not implement external egress filtering. Limiting factors: requires authenticated access to MLflow, not exploitable by anonymous attackers; impact scope depends on MLflow server's network position and IAM role permissions; organizations using network segmentation or restrictive egress policies may already block exploitation paths to critical internal targets.

CVSS 7.1 (High) with network vector (AV:N), low complexity (AC:L), low privileges required (PR:L), and high confidentiality impact (C:H) accurately reflects the technical severity. However, real-world exploitation risk is moderated by the authentication requirement - attackers need valid MLflow credentials with webhook creation permissions. The SSRF can access cloud metadata services (AWS/Azure/GCP instance metadata at 169.254.169.254), potentially stealing IAM credentials, API keys, and environment variables. Internal network scanning and service enumeration are also possible. No CISA KEV listing indicates no widespread exploitation detected, and EPSS data is not provided but likely low given the authentication barrier and specific product targeting. The vulnerability requires MLflow to be deployed with webhook functionality enabled - organizations not using MLflow webhooks are unaffected even on vulnerable versions. Patch availability since version 3.9.0 with clear commit evidence (64aa0ab) reduces ongoing risk for maintained deployments. Priority should be elevated for MLflow instances handling sensitive workloads in cloud environments with IAM role-based authentication, where metadata endpoint access could enable privilege escalation. Lower priority for air-gapped or network-isolated MLflow deployments where SSRF impact is constrained.

An authenticated attacker with MLflow access creates a malicious webhook pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/. When an MLflow event triggers the webhook (model registration, experiment completion), the MLflow backend sends an HTTP POST request to the AWS EC2 metadata service. The attacker receives the response containing temporary IAM credentials through webhook delivery logs or by pointing the webhook to an attacker-controlled external server that logs the forwarded request. With stolen IAM credentials, the attacker escalates privileges in the AWS environment, accesses S3 buckets containing training data, or pivots to other cloud resources. Alternatively, the attacker enumerates internal services by creating webhooks to internal IP ranges and observing response timing or error messages to map the internal network topology.